| CVE-2026-56182 | Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-56173 | Use after free in Windows WebView allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-56648 | Time-of-check time-of-use (toctou) race condition in Windows Network File System allows an authorized attacker to elevate privileges over a network. | high | |
| CVE-2026-55137 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-55131 | Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-55036 | Buffer over-read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-50313 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-50667 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50672 | Use after free in Windows NTFS allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50326 | Use after free in Windows Unified Consent System allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50335 | Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50348 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network. | high | |
| CVE-2026-50336 | Heap-based buffer overflow in Windows Media allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50337 | Incorrect type conversion or cast in Windows Notification allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50684 | Improper neutralization of input during web page generation ('cross-site scripting') in Active Directory Federation Services (AD FS) allows an authorized attacker to perform spoofing over a network. | medium | |
| CVE-2026-50509 | Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50365 | Improper authentication in Windows RPC API allows an unauthorized attacker to elevate privileges over an adjacent network. | high | |
| CVE-2026-50368 | Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-50490 | Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50378 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Key Guard allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50376 | Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network. | medium | |
| CVE-2026-50352 | Exposure of sensitive information to an unauthorized actor in Windows Cryptographic Services allows an authorized attacker to disclose information locally. | medium | |
| CVE-2026-50493 | Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50426 | Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network. | medium | |
| CVE-2026-50427 | Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50433 | Use after free in Windows Media allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50421 | Access of resource using incompatible type ('type confusion') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50449 | Use after free in Windows Runtime allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50462 | External control of file name or path in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-50452 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an unauthorized attacker to elevate privileges over a network. | high | |
| CVE-2026-47302 | Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-50046 | In NLnet Labs Unbound 1.15.0 up to and including 1.25.1, the TLS server name used for DNS-over-TLS (DoT) forwarded queries is tied to a struct's ('serviced_query') lifetime but also referenced by another struct ('waiting_tcp'). When the owning struct is jostled out of the mesh while the DoT TCP stream is still handshaking it frees the storage behind the referenced string and if the TLS stream then errors out, it dereferences the freed pointer. The dereference is read-only and the practical impact is a daemon crash resulting in denial of service. A malicious actor that knows a DoT forwarding/stub Unbound's configuration could exploit the vulnerability by quering records in the appropriate zone while keeping Unbound uder pressure so that the jostle logic kicks in. If answers for the vulnerable zone are slow, the likelihood of jostling such queries is higher, although the timing of the jostle needs to be precise. Requirements for a vulnerable Unbound is the existence of a stub/forward zone configured for DoT together with a configured '#authname' suffix on the server identification. The connectivity to the server needs to exhibit a transient failure at the correct time in order to kick off the vulnerable error path. | medium | |
| CVE-2026-55991 | In NLnet Labs Unbound 1.22.0 up to and including 1.25.1, a remote unauthenticated client can trigger a libngtcp2 assertion (if compiled with assertions on) and terminate the entire Unbound process using a single DNS-over-QUIC (DoQ) connection and one normal DNS query. This is caused by an erroneous error value passed to libngtcp2. When 'ngtcp2_conn_writev_stream()' returns 'NGTCP2_ERR_STREAM_DATA_BLOCKED', Unbound continues to call 'ngtcp2_ccerr_set_application_error()' with a '-1' error value. The 'int' literal '-1' is implicitly converted to the function's 'uint64_t error_code' parameter as '0xFFFFFFFFFFFFFFFF'. The follow-on 'ngtcp2_conn_write_connection_close()' serialises that value as a QUIC variable-length integer; because '2^64-1' exceeds the 62-bit varint ceiling, 'ngtcp2_put_uvarintlen()' fails 'assert(n < 4611686018427387904ULL)' and the whole resolver process aborts. A remote, unauthenticated DoQ client can trigger this deterministically with a single QUIC connection by advertising 'initial_max_stream_data_bidi_local = 1' in its transport parameters and sending one DoQ query without ever reading the stream. | medium | |
| CVE-2026-65802 | External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclose information over a network. | high | |
| CVE-2026-70336 | Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network. | high | |
| CVE-2026-70316 | Improper input validation in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-64915 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-62753 | Heap-based buffer overflow in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-70304 | Heap-based buffer overflow in Windows DNS allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62741 | Integer underflow (wrap or wraparound) in Windows HTTP.sys allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-62752 | Heap-based buffer overflow in Windows Kerberos allows an authorized attacker to elevate privileges locally. | high | |
| CVE-2026-45646 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-56170 | Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-58279 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. | medium | |
| CVE-2026-55130 | Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-47642 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-50524 | Improper validation of specified type of input in .NET Framework allows an unauthorized attacker to deny service over a network. | high | |
| CVE-2026-65656 | Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to execute code locally. | high | |
| CVE-2026-63528 | Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally. | medium | |
| CVE-2026-61925 | Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally. | high | |
